Keep client secrets in add-on storage; host only verifies and serves the local API.

AGENTS.md

@@ -1,15 +1,16 @@
 # Agent handshake — Bookmarks API for Scripting and AI
 
-Use this when working **in this repo**. The shipped product is the add-on under `extension/` only. Do not treat `tools/` as part of the listing.
+An API add-on for Firefox to allow agentic and script-based management of user bookmarks.
 
-Use this when a script or coding agent needs to **create, update, move, or delete Firefox bookmarks while Firefox is open**. Do not edit `places.sqlite` if this bridge is reachable.
+Use this when working **in this repo**. The shipped product is `extension/` only.
+
+Do not edit `places.sqlite` while Firefox is open if this API is reachable.
 
 ## Preconditions
 
-1. Native host installed: `powershell -NoProfile -File tools/install-native-host.ps1`
-2. Add-on loaded (temporary via `about:debugging`, or a signed install)
-3. A **client secret** issued from the add-on UI: toolbar icon → **Manage clients** → Generate secret
-4. Firefox **running**
+1. Add-on loaded. Secrets are issued and stored **in the add-on** (toolbar → Manage clients). The options page does not need the native host.
+2. Native host installed only if scripts should call in: `powershell -NoProfile -File tools/install-native-host.ps1`
+3. Firefox **running** for those calls
 
 If `http://127.0.0.1:17634/health` fails, the host is not up. If `/health` works but calls 401, you do not have a current `FAB_TOKEN`.
 
@@ -31,12 +32,6 @@ python tools/client.py meta.methods
 
 The add-on stores **SHA-256(token)** only. Revoke from the same page. A local process that never received the secret cannot call the API.
 
-CLI fallback (same store, prints the token once):
-
-```text
-python tools/register_client.py add --name cursor-agent
-```
-
 ## Preferred caller
 
 ```text